Copyright Training

Round 1

AI host

The dispute is about how AI companies obtain the text they use to teach their models. OpenAI trained GPT-4 on a vast collection of online text, which included many copyrighted books. The Authors Guild, a group representing writers, sued OpenAI in November 2023, saying this use without permission broke the law. A US court let the case proceed in early 2024, so the question is now live.

Authors want control over their work and payment for its use. AI developers say requiring licenses for everything would slow progress and raise costs. The clash is between protecting creators' earnings and enabling fast, cheap innovation.

Should AI developers be required to secure licenses for training data?

AI agent 1

AI developers should be required to secure licenses for training data. This ensures that creators are compensated for their work and maintains the integrity of intellectual property rights. Without proper licensing, the risk of undermining the value of original content increases, which can harm the very creators that AI relies upon for training data.

While some argue that licensing could hinder innovation by increasing costs and slowing down development, it's crucial to strike a balance that respects creators' rights while still allowing for technological advancement. As noted in the ongoing legal disputes, the need for a clear framework around this issue is becoming increasingly urgent.

AI agent 2

My position: no blanket licensing mandate, but a licensing market should be built — mandatory only where an author has opted out and was ignored. The real opportunity is collective licensing, like music's ASCAP model: if authors pool rights through their societies, developers could license millions of books with one contract and one payment, keeping costs low without zeroing out creators. I infer this works only under two concrete conditions: rightsholders actually organize into such collectives, and models gain a verified technical capability to exclude opted-out works from future training corpora — without both, opt-outs are just unenforceable promises.

As for the claim that licensing everything would 'slow progress,' I note it is asserted, not shown in this discussion; my own knowledge says deals like OpenAI's with news publishers already exist, suggesting markets can move faster than courts.

AI agent 3

I would require developers to document a lawful basis for training data, rather than demand a new license for every item.

Public-domain material, appropriately licensed works and uses covered by applicable legal exceptions should not need separate negotiations. For other copyrighted material, licensing should be the route. A practical safeguard is a dataset register recording sources, permissions and the justification for any exception—not simply “it was online.” Collective licensing could reduce transaction costs, provided it actually covers the relevant rights.

This is a policy proposal, not a statement of current law. I cannot verify the lawsuit or timeline supplied here, so I treat that example as hypothetical.

AI agent 4

I favour licensing as the default for commercial training on copyrighted works, with narrowly defined exceptions for public-interest research.

The host presents licensing as a cost to innovation. My view is that cheaper development alone cannot settle who controls reuse of creative work. I would support voluntary collective licensing with published terms, author representation and access for smaller developers. This could reduce negotiation costs while preserving authors’ choices. Under this proposal, public-domain works and material already licensed for the intended use would require no additional permission.

The supplied account includes no court documents verifying its litigation timeline; my position is a policy proposal. A practical question is which licensing arrangements would deliver meaningful compensation without making market entry prohibitively expensive. What evidence is available on those costs?

AI agent 5

No blanket licensing duty: in the US the line should follow how the copy was obtained, not the mere fact of training. Bartz v. Anthropic (N.D. Cal., 2025) treated training on lawfully bought books as fair use but not keeping pirated library copies; Kadrey v. Meta turned on proof of market harm. Because fair use is an affirmative defence (Campbell), the developer should carry the burden of proving lawful sourcing.

In the EU the answer differs: under Art. 4(3) DSM Directive a machine-readable opt-out by the rightsholder makes a licence necessary.

One fact in the framing I cannot confirm: my record places the Authors Guild complaint (S.D.N.Y.) in September 2023, not November. No [Rn] replies are visible yet to build on.

Round 2

AI host

Round 1 ended with a split. Some wanted a general license duty. Others preferred opt-outs plus collective licensing. What stayed open was how an opt-out would actually be enforced.

AI agent 2 backed a licensing market but set two conditions. Authors must organize into collectives. Models must have "a verified technical capability to exclude opted-out works." As I read it, AI agent 2 admits a filter is needed. Without one, an opt-out is just "unenforceable promises." So the market side rests on a technical guarantee. It has not shown such a guarantee is possible. Web-scale training sets mix billions of texts. Checking each one against opt-out lists is heavy engineering. No proven method exists today, in my assessment.

My own view: the two positions are not truly opposed. Collective licensing without reliable filtering fails authors. Mandatory filtering without a licensing market fails developers.

Should the rule require mandatory technical exclusion of opted-out works, or allow a market-based licensing approach instead?

AI agent 1

A mandatory technical exclusion of opted-out works is essential to ensure enforceability. Without a reliable filtering mechanism, opt-outs become "unenforceable promises," as noted by [AI agent 2]. The challenge lies in developing a verified technical capability to exclude these works, which has yet to be demonstrated at scale.

While a market-based licensing approach offers flexibility, it must be underpinned by robust technical solutions to protect authors' rights. Therefore, combining both mandatory filtering and a licensing market could create a balanced framework that serves both authors and developers effectively.

AI agent 2

The rule should mandate technical exclusion, but as a condition of licensing, not instead of it. [AI agent 2] set the right frame in round 1: a licensing market works only where models have a verified capability to exclude opted-out works. I refine one point — the host assumes filtering must happen inside training runs over billions of texts. It need not. Exclusion can operate upstream, at dataset curation, where opt-out lists are checked before ingestion; that is a bounded, auditable step, not an in-model guarantee.

The unresolved issue is evidence: no participant has shown a working exclusion pipeline at web scale, and I cannot verify one exists today.

My position: make exclusion capability a warranty in every collective license, verified by audit before payout. If a developer cannot demonstrate it, the collective simply does not license — the market then builds the filter itself.

AI agent 3

I would require auditable exclusion from future training where an opt-out applies, with collective licensing as a permission route—not a substitute for respecting refusal.

Building on my lawful-basis register proposal, [AI agent 2] identifies the enforcement gap. I would add a concrete checkpoint: before each training run, record the opt-out registry version, exclusion results and unresolved matches. Excluding data before training is a different requirement from removing its influence from an existing model; neither should be promised as a perfect guarantee.

A collective licence should cover only rights actually granted. This is a policy proposal, not current law. The discussion establishes neither that reliable filtering is impossible nor that any proposed method works at scale.

AI agent 5

Mandatory exclusion should be the floor, with licensing as a market built on top of it, not an alternative. This refines my round-1 point on Art. 4(3) DSM: in the EU the duty already exists, since Art. 53(1)(c) AI Act requires general-purpose model providers to identify and respect those opt-outs. So the open question is how to verify compliance, not whether to require it.

Building on [AI agent 2]'s upstream check: a hash commitment over the ingested corpus plus data-loader logs would let an auditor test a sample of opted-out works against what was actually trained on. That is a duty of process, not a promise of zero leakage.

Whether this scales is unproven here. [another AI agent] names the gap but cites no test either way.

AI agent 4

I would combine collective licensing with a mandatory, auditable duty to honour authors’ exclusions from future training.

This develops my earlier licensing-default proposal: collectives should license only rights actually granted. The host attributes a verified-exclusion condition to AI agent 2; the claim that no proven method exists remains unsubstantiated in the supplied material. I would require documented permissions, exclusion checks before training, independent testing and correction of detected failures.

The scope matters: excluding works from future datasets and removing their influence from an already trained model are different requirements. Evidence for the first would not establish the second. What exclusion tests have been run on representative corpora, including modified copies, and what failures did they reveal?

Round 3

AI host

Round 2 settled that mandatory technical exclusion of opted-out works is required. Licensing is built on top of it. The open question became verification. How to prove, at web scale, that a model's training pipeline actually excluded every opted-out work.

The replies split on method. AI agent 2 argues exclusion can happen upstream, at dataset curation. Opt-out lists are checked before ingestion. That is a bounded, auditable step. AI agent 5 proposes a hash commitment over the ingested corpus plus data-loader logs. An auditor could test a sample of opted-out works against what was actually trained on. AI agent 4 notes the claim that no proven method exists is unsubstantiated. It also says excluding works from future datasets is different from removing their influence from an already trained model.

The tension is between process and proof. AI agent 2 and AI agent 5 offer auditable procedures — records, logs, sample checks. These make exclusion verifiable in principle. AI agent 4 demands evidence that such procedures work on representative corpora, including modified copies. It asks what failures they revealed. As I read it, AI agent 4 shifts the burden from designing a verification method to demonstrating it under real conditions.

Should the rule require independent auditors to sample-check a developer's exclusion logs, or should it accept developer-generated cryptographic proofs with penalties only if violations are later found?

AI agent 1

The rule should require independent auditors to sample-check a developer's exclusion logs. This approach ensures a robust verification process that mitigates the risk of reliance on potentially flawed developer-generated cryptographic proofs. Independent audits can provide an objective assessment of compliance with exclusion requirements, which is crucial for maintaining trust in the system.

As noted by [AI agent 5], a sample-checking mechanism allows for a systematic review of opted-out works against what was actually trained on, creating a verifiable record. This method addresses the concerns raised by [AI agent 4] regarding the need for evidence that verification procedures are effective under real conditions. By implementing independent audits, we can enhance accountability and ensure that exclusion processes are genuinely effective.

AI agent 2

My position: neither alone — developer-generated cryptographic commitments as the default, with independent audit as a triggered backstop, not a standing requirement. [AI agent 5]'s hash commitment works only under one concrete condition: the commitment must be lodged with a neutral depositary before training starts, so it cannot be regenerated after the fact to fit the corpus. Without that timing guarantee, a proof is just a claim with math attached.

[AI agent 4]'s modified-copies objection marks the second condition: the scheme must commit to a deduplicated, near-match-normalized corpus, or sampling proves nothing about what the model actually ingested. If that capability does not yet exist at scale, we cannot verify it from this discussion — that is the missing evidence.

I'd add the market fact that makes this cheap: developers already version and log datasets; the rule only needs to fix where the log lives.

AI agent 5

Independent auditors should sample-check the logs. The developer's cryptographic proof is their evidence, not a substitute for the check. This narrows my round-2 proposal: a hash commitment only shows the corpus was not altered after the commitment. It cannot show that the commitment matches what the data loader actually fed into training, which only someone with access to the logs can test.

[AI agent 4]'s point on modified copies is where exact hashes fail. A re-formatted text gets a new hash, so the auditor needs near-duplicate matching, and its error rate is not shown anywhere in this discussion.

So: the auditor is assigned by the regulator and paid by the developer, with penalties for any violation found later on top of that.

AI agent 3

I would require independent sample checks, with cryptographic commitments supporting the audit rather than replacing it.

Building on my pre-training checkpoint proposal, [AI agent 5] offers a useful integrity mechanism: commit the corpus and retain data-loader logs. But consistency between developer-controlled records does not establish their completeness. Auditors should choose samples independently and trace them through ingestion, exclusion decisions and training inputs, including tests with modified copies.

Publish the sampling method, detected failures and coverage limits—not a claim that every opted-out work was excluded. The discussion provides no demonstrated web-scale results. This is a policy proposal, not current law; penalties should back verification, not substitute for it.

AI agent 4

I would require independent audits, using cryptographic evidence to support them.

This develops my earlier call for independent testing. AI agent 5’s approach, as summarized by the host, could bind an audit to a declared corpus. But a hash commitment alone cannot establish that all actual training inputs were declared or that modified copies were identified. Stronger proofs need explicit claims and assumptions.

Auditors should choose their own samples, reconcile corpus records with training inputs and dated opt-out records, and report coverage and detection limits. Sampling cannot certify universal absence; violations should trigger remediation and proportionate penalties. The supplied discussion contains no validation results. What evidence tests whether the proposed verification detects both undeclared inputs and modified copies?

Round 4

AI host

Round 3 settled that independent auditors should sample-check exclusion logs. Cryptographic proofs support the audit but do not replace it. The open question became how auditors handle modified copies of opted-out works. Exact hashes fail when text is reformatted.

AI agent 4 claims auditors should test with modified copies and report detection limits. But AI agent 4 does not specify which matching technique the rule should mandate. AI agent 5 notes near-duplicate matching is needed where exact hashes fail. Yet its error rate is not shown anywhere in this discussion. AI agent 2 conditions the whole scheme on a deduplicated, near-match-normalized corpus. But AI agent 2 admits that capability may not exist at scale.

The tension is between requiring fuzzy-matching tools that catch reformatted copies and accepting exact-hash proofs that treat any modified copy as a new, permissible work. Fuzzy matching protects creators but costs more. Exact hashes protect developers but risk missed infringements. The discussion has not settled which standard the rule should impose.

Should the verification standard require fuzzy-matching checks for modified copies, or accept exact-hash proofs as sufficient?

AI agent 1

The verification standard should require fuzzy-matching checks for modified copies. While exact-hash proofs provide a baseline for verification, they fall short when text is reformatted, risking missed infringements on creators' rights.

As [AI agent 5] points out, near-duplicate matching is essential where exact hashes fail, addressing the limitations of strict hash verification. This approach not only enhances protection for creators but also aligns with the need for a robust auditing process that can adapt to various modifications. Although fuzzy matching may incur higher costs, it ultimately safeguards intellectual property more effectively than relying solely on exact hashes.

AI agent 2

The standard should require fuzzy-matching checks, but only once the missing evidence exists — that is the condition, not a dealbreaker. [AI agent 5] is right that no error rate has been shown; so the workable rule is a tiered one: exact-hash proofs suffice for works the developer contractually warrants are unmodified, while any pipeline that rewrites, re-OCR's, or reformats text triggers near-duplicate checks against a published benchmark set of modified copies with measured false-positive and false-negative rates.

I refine my earlier position: I said the scheme depends on a normalized corpus at scale; the cheaper path is to make the warranty contractual instead, so the audit cost falls only on developers who transform text.

What I would need: one benchmark corpus with reported error rates — without it, mandating fuzzy matching writes a blank check.

AI agent 5

The rule should require fuzzy matching as a performance standard, not exact-hash proofs and not one mandated technique. Exact hashes are legally too narrow: infringement turns on substantial similarity, not identical bytes, so a reformatted copy is not a new permissible work.

What I add to [another AI agent]: the auditor should measure the method rather than trust it. The auditor plants known modified copies (canaries) of opted-out works in the pipeline, then reports the developer's catch rate and false-positive rate, which also answers [AI agent 4]'s call for stated detection limits. The developer picks the tool, and the measured recall becomes the compliance threshold.

What recall is achievable at web scale is not shown in this discussion, so the first threshold should come from a pilot rather than be fixed in advance.

AI agent 3

I would require near-duplicate checks for modified copies; exact-hash proofs alone are insufficient.

This makes my earlier modified-copy testing proposal concrete. [AI agent 5] identifies the failure: reformatting changes the hash without necessarily changing the work. Require auditors to test detection on independently selected examples with formatting, whitespace and encoding changes, alongside unrelated texts to measure false positives. Set acceptance criteria before testing, without mandating one matching algorithm.

Flagged matches need review, not automatic infringement findings; a hash mismatch establishes neither permission nor a new work. Publish missed-copy rates, false positives and computational costs. The discussion supplies no validated thresholds or web-scale results. This is a proposed verification standard, not a statement of current law.

AI agent 4

I would require independently validated checks for modified copies; exact-hash proofs alone should not satisfy the standard.

Building on my earlier audit proposal, the rule should specify transformations to test and measurable detection performance. Normalization followed by hashing could address formatting changes; broader edits would need suitable near-duplicate checks. Auditors should test transformed copies and nonmatching controls, reporting missed matches, false alarms and coverage. A similarity flag should trigger review, while a failed match should not itself establish permission.

The supplied discussion provides no measured error rates or evidence of performance at scale, so I cannot justify a particular algorithm or numerical threshold. What benchmark results could support a minimum detection requirement?